What is the CVSS score of CVE-2026-17950?

CVE-2026-17950 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17950?

Google Chrome on macOS is vulnerable to remote code execution through a Safe Browsing component flaw (CVE-2026-17950, CVSS 8.8) when users download or open malicious files.. A patch is available.

How to fix or mitigate CVE-2026-17950?

Within 24 hours, audit your macOS fleet for Chrome versions below 151.0.7922.72 and establish baseline inventory. Over the next 7 days, deploy Chrome 151.0.7922.72 Stable to all macOS systems through your endpoint management platform, prioritizing users who frequently download or open files from external sources. By day 30, validate that all Chrome instances across the macOS fleet have been updated to 151.0.7922.72 or later and confirm patch adoption rates exceed 95%.

Google Chrome CVE-2026-17950

EUVD-2026-50876 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-whvp-r9r4-24v4

Privilege Escalation RCE Google Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote malicious file needs one user action (UI:R) but no privileges (PR:N); Safe Browsing RCE yields full code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:39 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

8.8 (None) 8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 151.0.7922.72 stems from an inappropriate implementation in the Safe Browsing component, where a remote attacker can trigger arbitrary code execution by luring a victim into opening or downloading a malicious file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) requires no privileges but does require user interaction, and Google has shipped a fixed Stable channel build. Despite the 8.8 CVSS, Chromium rated the underlying issue Low severity, EPSS is only 0.20% (10th percentile), and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Safe Browsing subsystem - the Google service that inspects downloaded files and visited URLs against reputation lists to warn users of malware and phishing. An 'inappropriate implementation' here means the feature's file-handling logic behaves in a way that a malicious file can subvert to reach a code-execution path. The vulnerability is filed under CWE-269 (Improper Privilege Management), and the tags (RCE, Privilege Escalation) suggest the malicious file leverages a privilege/trust boundary weakness in how Safe Browsing processes it. The affected platform is specifically the macOS build of Chrome (CPE cpe:2.3:a:google:chrome), so the identical Windows/Linux binaries are not necessarily impacted the same way.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome on macOS to 151.0.7922.72 or later via Chrome's built-in updater (chrome://settings/help) and relaunch the browser to apply it, per Google's Stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the updated build through MDM/enterprise policy and force a relaunch to ensure the patched binary is active. As an interim compensating control before updating, advise users not to open or download untrusted files and, where policy allows, restrict downloads from untrusted sites; note this does not remove the flaw and reduces usability. Since Safe Browsing is the affected component, disabling it is counterproductive - it would remove other protections without reliably closing this path - so upgrading is strongly preferred over any toggle-based workaround.